MP300 SC1 + MP300 SCL1

Spy a complete NFC transaction using the combination MP300 SC1 + MP300 SCL1

  • Simple synchronisation link

  • Contact and contactless exchanges displayed on the same time base

  • Convenient data display thanks to the MPManager software suite

  • All specific functionalities of the testers remain present


The main features of the combination MP300 SC1 + MP300 SCL1 are :

  • Spy of ISO/IEC 7816-3, SWP, ISO/IEC 14443, FeliCa, ISO/IEC 15693 exchanges on one single session
  • Convenient display of the captured data using the MPManager software
  • Simple to setup
  • Possibility to measure translation time of a contactless frame into SWP by a NFC component
  • All features of both MP300 testers remain available
  • Enables to capture a complete NFC transaction
  • Also compatible with dual interface smartcards

 

The combination of MP300 SC1 + MP300 SCL1 will typically be used in the following contexts :

  • Characterisation of a NFC host component
  • Debug of a CLF (contactless front end)
  • Analysis of a combi card

 

MP300 SC1 : Suppported protocols

Protocol analysis mode

ISO/IEC 7816-3
T=0 and T=1 protocols
  • 100% implemented
Block level spy
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available
HCI
  • Available

Synchronous chips (memory chips)
Implemented
Example of supported chips
  • Eurochip
  • T2G
  • SLE 4442
  • SLE 4407
  • AT24CXX

USB 2.0
Supported speeds
  • Low speed, full speed

Smartcard emulation mode

ISO/IEC 7816-3
T=0 and T= 1 protocol
  • 100% implemented by firmware
Custom protocol emulation
  • Available

SWP (ETSI TS 102 613 and TS 102 622)
Baudrate supported
  • From 49kbps to 1.9 Mbps
Block level spy
  • Available
LLC level spy (S_HDLC, ACT, CLT)
  • Available

MP300 SC1 : Programmable parameters

Protocol analysis mode

ISO/IEC 7816-3
I/O direction detection threshold

SWP (ETSI TS 102 613 and TS 102 622)
SWP S2 channel current threshold

Smartcard emulation mode

ISO/IEC 7816-3
Guard time
  • Defined in ETUs
Smartcard response time
  • Defined in ETUs

SWP (ETSI TS 102 613 and TS 102 622)
Current values on SWP S2 signal (high and log stated)
  • From 1nA to 2mA
Smartcard response time

MP300 SC1 : Spy feature

Accuracy
  • 20ns
Signals displayed
  • Signals C1, C2, C3, C4, C6, C7, C8
  • SWP S1, SWP S2
  • Trigger in
  • Trigger out
Protocols supported
  • ISO/IEC 7816-3, SWP, USB 2.0 (simultaneous spy possible without accuracy damage)
Type of events displayed
  • Logical state change
  • Characters
  • Modification of baudrate
  • Clock frequency detection
  • Analog representation of the signals
  • I/O direction

MP300 SC1 : Available tests

Electrical measurement (available for all versions)
Possibility to execute simultaneous voltage and current measurement to characterise both the terminal and the smartcard
Number of samples
  • 512000 (unlimited for Vcc)
Contacts available
  • C1, C6, C7

Perturbations (smartcard emulation mode)

ISO/IEC 7816
Sending out of standard blocks (wrong CRC, wrong data length, ...)
Sending characters with parity error
Simulating reception of parity errors
Modifying the guardtime on the fly

SWP (ETSI TS 102 613 and TS 102 622)
Sending out of standard blocks
Removal of bit stuffing
Card response time
Master resume time measurement

MP300 SCL1 : Protocols supported

ISO/IEC 14443
Type A
  • Available
Type B
  • Available
Supported baudrates
  • 106, 212, 424, 848 kbps
Anticollision
  • Managed by firmware
T=CL protocol
  • Managed by firmware

Mifare TM
Supported versions
  • Classic
  • Light
  • Ultra light
  • Ultra light C

ISO/IEC 15693

FeliCa TM
Supported baudrates
  • 212 and 424 kbps

Out of standard protocols
Gives the possibility to exchange frames without any protocolary encapsulation

MP300 SCL1 : Programmable parameters

Logical parameters
FDT,TR0, TR1, SOF, EOF, EGT
  • Adjustable in clock cycles

Physical parameters
Load modulation of the emulated smartcard
  • Adjustable (phase and amplitude can be defined)
Generation of EMD (Electro Magnetic Disturbance)
  • Available

MP300 SCL1 : Spy feature

Resolution
  • 20ns
Events displayed
  • Carrier and subcarrier detection
  • Type A sequences
  • Phase changes
  • Bytes
  • Frames
  • User events
  • Trigger in
  • Trigger out
  • I/O direction
  • Baudrate changes (asymetrical baudrates are supported)

 

MP300 SCL1 : Card emulation programming modes

Scenario mode
  • Timings are respected to the clock cycle, deterministic approach
Event driven mode
  • The user defines the reaction of the emulated smartcard on reception of events, with possibility to define the reaction depending on the event and the value of the received frames

MP300 SCL1 : Communication parameters

USB 2.0
TCP/IP 10/100 Mbps
RS 232

MP300 SCL1 : Software development

Remote development (the code is executed from the PC)
Elements available
  • Communication Dll supplied
Supported programming languages
  • C, C++, VB, Java, .NET
  • Any language that supports Dll

Embedded development (the code is executed directly by the MP300)
Recommended cross compiler
  • Windriver compiler (prefered version : 4.4b)

MP300 SCL1 : User Interface

MPManager

The software that is used for the display of the trapped exchanges is MPManager.

Once the spy session is over, the “Viexer” window of MPManager shows all signals that have been spied (contact and contactless exchanges)

 
Here, exchanges in SWP and ISO 14443B have been spied simultaneously


 

The viewer window of MPManager also gives a graphical display of the trapped exchanges.
For example on the following screenshot, we have a contactless command (starting a payment application). This command will be in fact executed by the U-SIM. The contactless frame thus needs to be translated into SWP

 
Here, contactless and SWP exchanges are displayed together, on the same time base


 

The time between the contact, and the SWP blocks, is the time it takes to the NFC component to do the translation job.
By positionning two cursors, we will know how long it takes to the NFC component to perform this job.

 
The blue cursor is set at the end of the contactless frame


 

 
The red cursor is set at the beginning of the SWP frame.


 

MPManager gives us the time difference between both cursors

 
It took 2.3 ms for the NFC component to do the translation


 


Micropross supplies a complete range of accessories for their laboratory tools, that include :

  • A SIM to ISO converter
  • Numerous shapes of probes, to use this tester with different types of contact smartcard readers and handsets
  • A probe to enable spying sessions between a smartcard and an external reader
  • A probe for oscilloscope connection

We also supply packages to extend the warranty of the tester. Please ask us for the maintenance contracts available.